Who Pays When Your AI Tool Gets It Wrong? (2026)

Short answer: usually, you do. Typical AI vendor terms, Anthropic's for example, disclaim accuracy, cap what the vendor owes at a year of fees, and offer indemnity mainly for copyright and other intellectual property claims. In India, the DPDP Act also makes you responsible for personal data your vendor processes for you, whatever the contract says. So before an AI tool answers customers or makes decisions, read four clauses and decide who checks its work.

What a typical AI contract actually says

Take one widely used example. Anthropic's Commercial Terms of Service, which govern business use of its API, are clear about three things.

• No promise of accuracy. Services and outputs are provided "as is", and Anthropic "disclaims that, the services or outputs are accurate, complete or error-free."
• A cap on damages. Each party's liability excludes indirect losses such as lost profits, revenue, goodwill or data, and is limited to the fees the customer paid in the previous 12 months.
• Indemnity for intellectual property. Anthropic will defend paid customers against third-party claims that their authorised use, or the outputs, infringe someone's intellectual property. It won't cover claims that come from your own inputs, outputs you modified, or outputs combined with other technology.

There's nothing unusual or unfair in this. It's how software contracts are generally written. But read it from the other side: if a chatbot built on that model quotes a customer the wrong price, or an AI agent sends a supplier the wrong order, the contract gives you very little to claim against. What you could recover is capped at the fees you paid in the previous 12 months, and lost business is excluded.

Other vendors word their terms differently, and enterprise contracts can be negotiated. The point is to read your own before you rely on it.

Even the model makers can't fully insure this

Anthropic's own S-1 filing, filed on 26 October 2026 for its planned share listing, says its insurance "may not provide sufficient coverage" for the liabilities it faces. It adds that for a catastrophic AI-related incident, "no single insurer, and potentially the insurance industry in the aggregate" may have the capacity to cover the exposure, and that the insurance market for AI-specific risks "is nascent and evolving."

That's legal caution in a risk-factor section, and it isn't a prediction of an incident. Still, it tells you something useful. If the company building the model is careful about what insurance will cover, a 40-person distributor shouldn't assume its own policies have the answer.

What Indian law puts on you

For personal data, the answer in India is already written down. Section 8(1) of the Digital Personal Data Protection Act, 2023 says a Data Fiduciary (the business that decides why and how data is used) is responsible for complying with the Act for any processing done on its behalf by a Data Processor, "irrespective of any agreement to the contrary."

An AI vendor that reads your customer chats, call recordings or CRM records is processing that data on your behalf. Section 8(2) says you may use a processor only under a valid contract. And the Act's schedule sets the penalty for failing to take reasonable security safeguards to prevent a personal data breach at up to ₹250 crore.

So a clause in which the vendor promises to protect your data is worth having, but it doesn't move your duty to them.

Insurance is only starting to catch up

A few insurers now sell cover written for AI. Armilla, a Lloyd's coverholder, offers a standalone AI liability policy covering third-party losses from inaccurate outputs and hallucinations, claims from AI agent mistakes such as failures to escalate, and data leaking through model outputs. Its site says most traditional policies "were written before generative AI," are silent on AI failure modes, and that some insurers have started adding AI exclusions.

Armilla says it distributes through licensed brokers in the US and Canada, so Indian firms may not be able to buy it today. The practical step is simpler: ask your broker whether your professional indemnity or cyber policy mentions AI at all, in either direction.

Four things to check before AI talks to customers

1. The accuracy disclaimer. Assume every output may be wrong. Decide which answers need a person to approve them: prices, refunds, delivery dates, anything legal or medical.
2. The liability cap. Compare it with the worst realistic mistake. If the cap is a year of a ₹20,000-a-month subscription and one wrong quote could cost a large order, the gap is yours to manage.
3. The indemnity scope. Check what's covered (usually intellectual property) and what's excluded. The mistakes an owner usually worries about, like a wrong answer to a customer, fall outside it.
4. The data terms. Confirm where customer data goes, whether it's used for training, and how fast the vendor tells you about a breach. Under the DPDP Act, that breach is still yours to report and answer for.

Customers already hold businesses to what their bots say. In 2024 a Canadian tribunal ordered Air Canada to compensate a customer after its chatbot described a refund policy that didn't exist, a case we covered in our post on AI first replies to enquiries. Write down who reviews the AI's work and how often, and keep a log of what it said. If something goes wrong, that record is what protects you, because the vendor contract mostly won't.